Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSFEEditor' = '"<Full path to file>" e'
Creates the following files on removable media
- <Drive name for removable media>:\correct.avi.mijnal
- <Drive name for removable media>:\openthetorbrouser.html
- <Drive name for removable media>:\archer.avi.mijnal
- <Drive name for removable media>:\split.avi.mijnal
- <Drive name for removable media>:\default.bmp.mijnal
- <Drive name for removable media>:\dial.bmp.mijnal
- <Drive name for removable media>:\dashborder_120.bmp.mijnal
- <Drive name for removable media>:\coffee.bmp.mijnal
- <Drive name for removable media>:\dashborder_96.bmp.mijnal
- <Drive name for removable media>:\sdksampleprivdeveloper.cer.mijnal
- <Drive name for removable media>:\testcertificate.cer.mijnal
- <Drive name for removable media>:\testee.cer.mijnal
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer.mijnal
- <Drive name for removable media>:\weeklysheet1215.doc.mijnal
- <Drive name for removable media>:\applicantform_en.doc.mijnal
- <Drive name for removable media>:\lisp_success.doc.mijnal
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Modifies file system
Creates the following files
- %APPDATA%\key.file
- %HOMEPATH%\desktop\openthetorbrouser.html
- %HOMEPATH%\desktop\readme_lock.txt
- D:\install.log.mijnal
- D:\openthetorbrouser.html
- C:\totalcmd\default.bar.mijnal
- C:\totalcmd\openthetorbrouser.html
- C:\far2\changelog.mijnal
- C:\totalcmd\descript.ion.mijnal
- C:\totalcmd\history.txt.mijnal
- C:\far2\openthetorbrouser.html
- C:\far2\changelog_eng.mijnal
Deletes the following files
- <Drive name for removable media>:\lisp_success.doc.mijnal
Miscellaneous
Executes the following
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=c: /on=c: /maxsize=401MB
- '<SYSTEM32>\vssvc.exe'
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=c: /on=c: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=d: /on=d: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=d: /on=d: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=e: /on=e: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=e: /on=e: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=f: /on=f: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=f: /on=f: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=g: /on=g: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=g: /on=g: /maxsize=unbounded
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=h: /on=h: /maxsize=401MB
- '%WINDIR%\syswow64\vssadmin.exe' Resize ShadowStorage /for=h: /on=h: /maxsize=unbounded
- '%WINDIR%\syswow64\wbem\wmic.exe' SHADOWCOPY /nointeractive
